ThreatFire Research Blog Home
 
 
« Out of Band Patch and Prevalent Client Side Exploitation
Clamping Down on Clampi »

P2P File Sharing and Limewire

In another “duh!” moment, it was discussed that government workers and contractors probably should not be sharing their drive contents using P2P software. In a recent hearing, U.S. lawmakers discussed sensitive content like “FBI files, medical records, Social Security numbers and even a file containing information about a safe house location for [the U.S.] President” that was accessed over LimeWire.

While this post does not present a stance on the policymaking or even the level of intelligence it takes to accidentally share drive contents over LimeWire, the ThreatFire continues to trigger and protect our community against a number of malware executables accessed over the LimeWire sharing network. Always be careful of the shared content on these networks — too often, things are too good to be true, as posted previously. Today, ThreatFire protected user information from more crackz bundled with malware, like another “Age of Mythology[ENGLISHVERSION] Crack Keygen” with a malicious setup file.

When the unsuspecting P2P user runs the setup file, this trojan downloader contacts a server at www.diespamdie. com, where adware and additional bot malware are served up. One of the served files includes a nasty bot sometimes identified by its packer, its circa 1999 injection technique, and its string references, Tdss.

This entry was posted on Wednesday, July 29th, 2009 at 12:41 pm and is filed under Bot, Social Engineering. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

Leave a Reply

Click here to cancel reply.

 
  • Blog Archive

    • March 2010
    • February 2010
    • January 2010
    • December 2009
    • November 2009
    • October 2009
    • September 2009
    • August 2009
    • July 2009
    • June 2009
    • May 2009
    • April 2009
    • March 2009
    • February 2009
    • January 2009
    • December 2008
    • November 2008
    • October 2008
    • September 2008
    • August 2008
    • July 2008
    • June 2008
    • May 2008
    • April 2008
    • March 2008
    • February 2008
    • January 2008
    • December 2007
    • November 2007
    • October 2007
    • September 2007
    • August 2007
  • Search This Blog

  • RSS Subscribe Now

    • FBI IC3 2009 Report
    • FakeAv Antivirus XP 2010
    • Troyak-AS De-peered for Good?
  • Categories

  • About ThreatFire

    ThreatFire™, features innovative real-time behavioral protection technology that provides powerful standalone protection or the perfect complement to traditional signature-based antivirus programs.

    ThreatFire's patent-pending ActiveDefense™ technology offers unsurpassed protection against both known and unknown zero-day viruses, worms, trojans, rootkits, buffer overflows, spyware, adware and other malware.

    Learn more...

  • Blogroll

    • A.M. Infosec
    • AV-Comparatives
    • iAntivirus
    • Mind Streams of Information Security Knowledge
    • Symantec Security Response
    • Tech Thoughts
    • ThreatExpert
  • Links

    • AMTSO
    • AV-Test
    • ICSA Labs
    • PC Tools
    • PC Tools is on Facebook
    • Reconstructer
    • ThreatExpert
    • ThreatFire
    • Uninformed
    • Virus Bulletin
 
Subscribe to:
Posts (Atom)
Entries (RSS) and Comments (RSS).